Question regarding the Admin Report

Greetings all:

My Zimbra server has been black listed and I cannot figure out if I have a spam bot on the network or a user account has been compromised. The spams are definitely going through the Zimbra server but I am not finding much in the logs to help me. I looked at a daily admin report and I need to clarify that the "Top 50 Senders" are, in fact, emails that are being sent from my server. There are SEVERAL addresses on this list that are NOT from my domain. Any help would be appreciated. Thank you.

My Zimbra server has been black listed and I cannot figure out if I have a spam bot on the network or a user account has been compromised. The spams are definitely going through the Zimbra server but I am not finding much in the logs to help me. I looked at a daily admin report and I need to clarify that the "Top 50 Senders" are, in fact, emails that are being sent from my server. There are SEVERAL addresses on this list that are NOT from my domain. Any help would be appreciated. Thank you.

Unfortunately you've given little information about what exactly is the problem nor have you provided any details of the ZCS version and release, post the output of the following command when you ask questions on the forums (and also update your forum profile with that information):

Code:

zmcontrol -v

Have you tested your server to see if it's an open relay (there plenty of test sites on the internet), What are you seeing in the log files that makes you think you're sending spam? Have you read any of the forum thread on this topic or the ones on "compromised account"? Have you made any changes to your server recently?

The server is not acting as an open relay - first thing I checked. Quite honestly I can't find anything in the logs simply because I don't know what to look for. In the Message Count Monitor in the admin I see where 855 emails were sent at 1:00am and that we are getting black-listed - backing up my contention that we are sending spam. I have made no changes to the server since it went online and I have been reading through the forums for the past three days trying to find some answers - none of which have panned out.

My question was regarding the admin report and the top 50 senders section. Are the senders listed in that report people who have sent emails from my server?